over-the-past – Tech Today w/ Ken May

Apple updates macOS and iOS to address Spectre vulnerability

Just a few days after Apple disclosed how it would be dealing with the Meltdown bug that affects modern computers, it’s pushed out fixes for the Spectre exploit as well. iOS 11.2.2 includes “Security improvements to Safari and WebKit to mitigate the effects of Spectre, ” the company writes on its support page, while the macOS High Sierra 10.13.2 Supplemental Update does the same for your Mac laptop or desktop. Installing this update on your Mac will also update Safari to version 11.0.2. The Spectre and Meltdown CPU vulnerabilities are a wake up call for the tech industry, affecting most of the processors made over the past twenty years. While companies like Microsoft , Apple and Google have been quick to issue fixes, it will still take a while to get everyone with a personal device up to speed. Hopefully the next generation of chips that power our own devices and those we use for the cloud will find a way to bust this exploit for good. Via: Rene Ritchie Source: Apple iOS , Apple macOS

Intel says it will patch 90 percent of recent chips by next week (updated)

A little more than a day since Google Project Zero went public with its findings regarding a major security flaw in Intel ( and others ) chip designs, the company announced that it is already is pushing out patches to eliminate the vulnerability. Intel has “already issued updates for the majority of processor products introduced within the past five years, ” per the company press release, and expects to have 90 percent of affected chips produced within the past five years patched by the end of the week. The flaw, which afflicts chips made over the past decade, enables ordinary processes to determine the layout of protected kernel memory. This “software analysis method”, as Intel describes the flaw, allows a pair of exploits, dubbed “Meltdown” and “Spectre, ” to swipe data from other apps on vulnerable devices — be they PCs, servers or mobile phones — running Intel, ARM or AMD chips. The solution cooked up by Intel and its partners so far entails severing the link between the kernel and these processes, though that could have a dramatic impact on a patched chip’s operating speed. The company asserts that the impacts will be “highly workload-dependent” and not particularly noticeable by the average consumer. Update: Microsoft says it will release an update for Surface devices to protect them against the chip vulnerability. The company also explains that it “has not received any information to indicate that these vulnerabilities have been used to attack customers at this time.” You can check the list of Surface gear that will receive the patch at the link above, but Microsoft says the updates will be available devices running Windows 10 with Windows Update or through the Microsoft Download Center. Source: Intel

More:
Intel says it will patch 90 percent of recent chips by next week (updated)

Russian hackers steal $10 million from ATMs through bank networks

The recent rash of bank system hacks goes deeper than you might have thought — it also includes stealing cash directly from ATMs. Researchers at Group-iB have published details of MoneyTaker, a group of Russian hackers that has stolen close to $10 million from American and Russian ATMs over the past 18 months. The attacks, which targeted 18 banks (15 of which were American), compromised interbank transfer systems to hijack payment orders — “money mules” would then withdraw the funds at machines. The first known attack was in the spring of 2016, when MoneyTaker hit First Data’s STAR network (the largest transfer messaging system for ATMs in the US). They also compromised Russia’s AW CRB network, and swiped documents for OceanSystems’ Fed Link system used by roughly 200 banks across the Americas. And in some cases, the group stuck around after the initial heist — at least one US bank’s documents were stolen twice, while the perpetrators kept spying on Russian bank networks. While it’s not clear who’s behind MoneyTaker, you’re only hearing about them now because they’re particularly clever. They’ve repeatedly switched their tools and methods to bypass software, and have taken care to erase their tracks. For instance, they’ve ‘borrowed’ security certificates from the US federal government, Bank of America, Microsoft and Yahoo. One Russian bank did manage to spot an attack and return some of the ill-gotten gains. This particular hack didn’t directly affect users, since it was more about intercepting bank-to-bank transfers than emptying personal accounts. However, it illustrates both the sophistication of modern bank hacks and the vulnerability of the banks themselves. While it would be difficult to completely prevent hacks, it’s clear that attackers are having a relatively easy time making off with funds and sensitive data. Via: Reuters Source: Group-iB (reg. required)

Excerpt from:
Russian hackers steal $10 million from ATMs through bank networks

Websites use your CPU to mine cryptocurrency even when you close your browser

Researchers have discovered a new technique that lets hackers and unscrupulous websites perform in-browser, drive-by cryptomining even after a user has closed the window for the offending site. Over the past month or two, drive-by cryptomining has emerged as a way to generate the cryptocurrency known as Monero. Hackers harness the electricity and CPU resources of millions of unsuspecting people as they visit hacked or deceitful websites. One researcher recently documented 2,500 sites actively running cryptomining code in visitors’ browsers , a figure that, over time, could generate significant revenue. Until now, however, the covert mining has come with a major disadvantage for the attacker or website operator: the mining stops as soon as the visitor leaves the page or closes the page window. Now, researchers from anti-malware provider Malwarebytes have identified a technique that allows the leaching to continue even after a user has closed the browser window. It works by opening a pop-under window that fits behind the Microsoft Windows taskbar and hides behind the clock. The window remains open indefinitely until a user takes special actions to close it. During that time, it continues to run code that generates Monero on behalf of the person controlling the Website. Read 4 remaining paragraphs | Comments

Original post:
Websites use your CPU to mine cryptocurrency even when you close your browser

Apple going all-in on original programming, to the tune of $1 billion a year

Apple Music on iOS 10, with Senior VP Eddy Cue. (credit: Andrew Cunningham) As the battle to create original content for online video services continues, we get a glimpse into Apple’s plans for the coming year. According to a report from The Wall Street Journal , Apple has a budget of $1 billion to spend in 2018 to “procure and produce” original content. The iPhone maker could acquire and produce up to 10 shows next year with this money, which will be largely left in the hands of new Apple hires Jamie Erlicht and Zack Van Amburg. Erlicht and Van Amburg are former presidents from Sony Pictures Television that moved to Apple in June to oversee video content strategy and production. The $1 billion budget signals how serious Apple is about boosting its original programming, the newest of which lives on its Apple Music subscription service. This is Apple’s first major push into original content, but $1 billion less than the money spend on content by rival companies. HBO spent about double last year on content (it reportedly costs $10 million to produce one episode of Game of Thrones ), and Netflix may spend upwards of $6 billion this year. Apple’s starting budget is similar to Amazon’s when it first got into original programming in 2013 with Prime Video; Amazon could spend $4.5 billion on original content in 2017. Original programming is the way to go, as it has proven to be a big driver in the growth of streaming services. Netflix’s business benefited immensely from original hits like House of Cards , Orange is the New Black , and Stranger Things . Those kinds of shows—scripted comedies and dramas—are expensive to produce, and we’ve seen Netflix’s annual budget for original programming increase over the past few years to accommodate that. Apple’s first original series, Planet of the Apps and Carpool Karaoke , both just became available to Apple Music subscribers, and critics’ reviews have been mixed. Read 2 remaining paragraphs | Comments

View article:
Apple going all-in on original programming, to the tune of $1 billion a year

AMD returns to high-end gaming graphics with Radeon RX Vega

AMD has been content to cater to budget gamers with its graphics cards over the past couple of years, but it’s ready to play in the big leagues once again. After plenty of leaks and no shortage of hype (Apple even name-dropped AMD at the iMac Pro debut), the chip giant has unveiled GPUs based on its high-end Vega architecture. The Radeon RX Vega series touts processors with numerous tweaks that promise to finally give AMD performance comparable to NVIDIA’s higher-end offerings, including updated geometry and pixel engines, a high-bandwidth cache controller and support for multiple data operations per cycle. Overall, Vega promises twice the throughput per clock cycle and twice the memory bandwidth per pin of earlier Radeon hardware — not the highest bar to clear given AMD’s recent lack of top-end cards, but still a huge improvement. AMD isn’t providing the most extensive benchmarks to go with the Vega launch, but its emphasis is on baseline performance over peak frame rates. Its highest-end models should offer a minimum of 53 frames per second when playing numerous games on an ultra-wide 1440p monitor, which is comfortably higher than the 45 of NVIDIA’s GeForce GTX 1080. AMD is almost certainly cherry-picking tests that favor its design (what about maximum FPS or 4K gameplay?), but it’s reasonable to say that its fastest GPUs are at least competitive with those of its arch-rival, which is more than we could say for a long, long while. Thankfully, the firm isn’t leaning on speeds alone to reel you in. The RX Vega line can handle single-cable 5K displays, which are hard to find outside of the Mac ecosystem . A software plugin gives you the first hardware-accelerated playback for 4K VR video. And if you spring for the most advanced board, you’ll get liquid cooling that promises both more headroom for overclocking and a quieter PC. You might pay for more than you were expecting, though. The line starts off with the usual stand-alone cards, including the $399 Radeon RX Vega 56 (named for its 56 compute units) and $499 Vega 64 Air Cooled (logically, 64 compute units). However, AMD is pushing the concept of Radeon Packs that bundle two games (in the US, Prey and Wolfenstein II ) and discounts on the prices of both a Samsung ultra-wide monitor as well as a Ryzen 7 -plus-motherboard combo. You’ll need to spend $100 more to get the Vega 56 and 64 Air boards with these packs, and the $699 Vega 64 Liquid Cooled is only available with a Radeon Pack. Also, be prepared to wait a little while: the whole Vega series ships on August 14th. Oh, and the company has one more piece of gamer-focused news in store. Remember that ludicrous 16-core Threadripper processor? It finally has a release date. The $999 beast arrives on August 10th alongside a more modest 12-core CPU ($799), while a ‘low-end’ 8-core part ($549) shows up on August 31st. Threadripper is absolute overkill for most home users and is really meant for people who juggle many apps at once, or just want to show off and have money to burn. However, it was impressive enough that it prompted Intel to fire back with the Core i9 . Clearly, both AMD and Intel see the value in over-the-top core counts, even if it’s just to help sell processors to gamers that insist on the best hardware. Source: AMD (RX Vega) , (Threadripper)

More:
AMD returns to high-end gaming graphics with Radeon RX Vega

Here’s our first look at Windows’ new adaptive interface

Microsoft has been steadily working on bringing the full Windows experience to devices of all types over the past few years, including PCs, phones and even the Xbox One. But there are still a few differences with how Windows runs across them. That’s why the company is developing CShell, a new version of the Windows Shell that can adapt to screen sizes of all types, as well as unify the overall experience. It’ll likely play a large role in Microsoft’s Fluent design strategy , which is broadly focused on scaling Windows to more devices. Now, we’ve got our first look at what CShell actually looks like on a Windows Phone, Windows Central reports . At first glance, CShell looks exactly like the current Windows shell on mobile. But dig a bit deeper, and you’ll notice some important changes. It gives you more size options for Live Tiles on the Start screen, for one. It also brings over the Action Center from Windows 10, and adds a landscape option for displaying the Start screen. CShell also gives Windows Continuum the ability to run several apps at once in windowed mode, instead of forcing them to be full screen. Given that that was one of our biggest gripes with Continuum , it’s a particularly useful upgrade. Source: Windows Central

Follow this link:
Here’s our first look at Windows’ new adaptive interface

Intel’s Core i9 Extreme Edition CPU is an 18-core beast

Last year at Computex, Intel unveiled its first 10-core consumer CPU , the company’s move into the world of a “megatasking.” It was a pricey chip, launching at around $1, 700, but it satisfied the needs for users who needed to juggle several intensive tasks at once. Now, Intel is upping the ante with a whole new family of processors for enthusiasts, the Core X-series, and it’s spearheaded by its first 18-core CPU, the i9-7980XE. Priced at $1, 999, the 7980XE is clearly not a chip you’d see in an average desktop. Instead, it’s more of a statement from Intel. It beats out AMD’s 16-core Threadripper CPU , which was slated to be that company’s most powerful consumer processor for 2017. And it gives Intel yet another way to satisfy the demands of power-hungry users who might want to do things like play games in 4K while broadcasting them in HD over Twitch. And as if its massive core count wasn’t enough, the i9-7980XE is also the first Intel consumer chip that packs in over a teraflop worth of computing power. If 18 cores is a bit too rich for you, Intel also has other Core i9 Extreme Edition chips in 10, 12, 14 and 16-core variants. Perhaps the best news for hardware geeks: the 10 core i9-7900X will retail for $999, a significant discount from last year’s version. All of the i9 chips feature base clock speeds of 3.3GHz, reaching up to 4.3GHz dual-core speeds with Turbo Boost 2.0 and 4.5GHz with Turbo Boost 3.0. And speaking of Turbo Boost 3.0, its performance has also been improved in the new Extreme Edition chips to increase both single and dual-core speeds. Rounding out the X-Series family are the quad-core i5-7640X and i7 models in 4, 6 and 8-core models. While it might all seem like overkill, Intel says its Core i9 lineup was driven by the surprising demand for last year’s 10-core chip. “Broadwell-E was kind of an experiment, ” an Intel rep said. “It sold… Proving that our enthusiast community will go after the best of the best… Yes we’re adding higher core count, but we’re also introducing lower core counts. Scalability on both ends are what we went after.” As you can imagine, stuffing more cores into a processor leads to some significant heat issues. For that reason, Intel developed its own liquid cooling solution, which will work across these new chips, as well as some previous generations. All of the new Core i9 processors, along with the 6 and 8-core i7 chips, feature scorching hot 140W thermal design points (TDPs), the maximum amount of power that they’ll draw. That’s the same as last year’s 10-core CPU, but it’s still well above the 91W TDP from Intel’s more affordable i7-7700K. Over the past few years, Intel’s laptop chips have been far more interesting than its desktop CPUs. Partially, that’s because the rise of ultraportables and convertible laptops have shifted its focus away from delivering as much computing power as possible, to offering a reasonable amount of processing power efficiently. The new Core i9 X-series processors might not be feasible for most consumers, but for the hardware geeks who treat their rigs like hot rods, they’re a dream come true.

More:
Intel’s Core i9 Extreme Edition CPU is an 18-core beast

Critical vulnerability under “massive” attack imperils high-impact sites [Updated]

Enlarge / One of two publicly available exploits for a critical Apache Struts vulnerability. (credit: Kevin Beaumont ) In a string of attacks that have escalated over the past 48 hours, hackers are actively exploiting a critical vulnerability that allows them to take almost complete control of Web servers used by banks, government agencies, and large Internet companies. The code-execution bug resides in the Apache Struts 2 Web application framework and is trivial to exploit. Although maintainers of the open source project patched the vulnerability on Monday , it remains under attack by hackers who are exploiting it to inject commands of their choice into Struts servers that have yet to install the update, researchers are warning. Making matters worse, at least two working exploits are publicly available. “If you run it against a vulnerable application, the result will be the remote execution of commands with the user running the server,” Vicente Motos wrote of one of the exploits in a post published late Wednesday afternoon on the Hack Players website. “We have dedicated hours to reporting to companies, governments, manufacturers, and even individuals to patch and correct the vulnerability as soon as possible, but the exploit has already jumped to the big pages of ‘advisories,’ and massive attempts to exploit the Internet have already been observed.” Read 8 remaining paragraphs | Comments

Originally posted here:
Critical vulnerability under “massive” attack imperils high-impact sites [Updated]

LED lights could get better with self-assembling particles

LEDs have dramatically transformed the lighting world over the past few years, thanks to their increased efficiency and life-span over past technologies. But LEDs could see even more upgrades with perovskite particles, a self-assembling nanoscale material that could make them even more efficient and cheaper to produce, Physorg reports . Researchers have already shown how perovskites could improve solar cells, but until now it was difficult to create uniform films made out of the material. “Our new technique allows these nanoparticles to self-assemble to create ultra-fine grained films, an advance in fabrication that makes perovskite LEDs look more like a viable alternative to existing technologies, ” said Barry Rand , an assistant professor of electrical engineering at Princeton and the lead researcher in the findings. Basically, this bodes well for the future of LEDs. It could eventually make it easier to developer LED panels for TVs and monitors, or drive down the cost of LED lighting. Lighting using the new technology are superior in many ways to old-school incandescent bulbs, or even slightly more modern fluorescent bulbs, but they still cost quite a bit more than the older competition. Via: Physorg Source: Nature

More:
LED lights could get better with self-assembling particles